International Association
for Cryptologic Research

We present new techniques for converting secret-shared values between different moduli in arithmetic MPC, without relying on bit decomposition. More concretely, our protocols convert a sharing \([x]_q\) over a source modulus \(q\) into a sharing \([x]_t\) over a target modulus \(t\), under a mild bound on the size of \(x\). We give three variants: a particularly simple protocol for power-of-two moduli, a protocol for arbitrary source modulus and prime target modulus, and a general protocol for arbitrary target modulus via an intermediate prime modulus. All variants use only a constant number of openings and a small amount of preprocessing. We present them in the arithmetic black box model, so they can be instantiated on top of any MPC protocol supporting basic modular arithmetic.

As a main application, we use these techniques to construct efficient threshold decryption protocols for lattice-based fully homomorphic encryption (FHE), including BFV, BGV, and related schemes. The resulting protocols are special-purpose MPC protocols with a small constant number of rounds. They avoid noise flooding, allowing the parameters of the underlying FHE scheme to be chosen without making room for additional decryption noise.

The resulting protocols achieve statistical UC security against malicious adversaries.

We improve substantially on previous work on MPC-based threshold FHE decryption: as a concrete example, the state-of-the-art protocol by Zyskind et al. (ACM CCS 2025) implements decryption of the BFV scheme (with ciphertext modulus $2^{64}$), using about 17.000 bits of preprocessed correlated randomness, while we need only 63.

(Multi-branch) Generalized Feistel Network~(GFN) enables the construction of block ciphers from non-linear components with small domains, and has been adopted in various block ciphers. Berger et al. (SAC 2013) introduced the Extended Generalized Feistel Network~(EGFN), which unified and extended existing Feistel-like structures by using a matrix representation.

Given an arbitrary matrix, it is typically difficult to determine how many EGFN rounds are sufficient for pseudorandom permutation (PRP) and strong PRP (SPRP) security. Remarkably, security proofs for structures with a larger number of branches have to analyze a huge amount of collision events, which is overly complicated and prone to errors.

To remedy this situation, we present AutoEGFN, a computer-aided proof tool that determines the number of rounds sufficient for PRP and SPRP security for various variants of EGFN. The tool operates by calculating three parameters: $r_1$, $r_2$, and $r_3$. The validity and soundness of AutoEGFN are formally established by a detailed security proof. To demonstrate the effectiveness of AutoEGFN, we have applied it to multiple structures such as Type-1/2 GFN (Zheng et al., CRYPTO 1989), YI11's Type-1 GFN (Yanagihara and Iwata, CANS 2011), DFLM19's GFN (Derbez et al., FSE 2019), DDGP22's GFN (Delaune et al., INDOCRYPT 2022), Type-1.x GFN (Yanagihara and Iwata, IEICE 2014), SH/TH GFN (Yanagihara and Iwata, CANS 2011), Nyberg's GFN (Nyberg, ASIACRYPT 1996), SM's GFN (Suzaki and Minematsu, FSE 2010), and BMT's EGFN (Berger et al., SAC 2013). As a result, we provide a systematic analysis of the (S)PRP security for Type-1 and Type-2 structures for different numbers of branches. Our tool efficiently determines the concrete number of rounds required to ensure PRP and SPRP security for EGFNs with different branch numbers. For comparison, previous work only proved the (S)PRP security for 8- and 16-branch BMT's EGFN. Our tool completes the proof within several minutes, even for variants with $32$ branches. Meanwhile, for the other structures, we provide the first concrete (S)PRP security proofs without any restrictions on their permutation layers. Furthermore, AutoEGFN will significantly contribute to the enhancement of EGFN designs and implementations in various cryptographic applications.

In this paper, we generalize to the multivariate setting the current state-of-the-art methods in the literature for the inference of bivariate polynomials constructed recursively, by means of repeated additions and multiplications. We present two main approaches: the first one based on polynomial interpolation and the second one relying on lattice-based techniques for solving modular knapsack-type problems. Both the directions yield natural and practical generalizations, supported by detailed analyses of the underlying mathematical structures. Our methods can be useful for analysing the security of cryptographic algorithms, given their connection to basic operations serving as building blocks, for example in fully homomorphic encryption schemes.

Hall-Andersen, Simkin and Wagner (CiC 1:4) show how to construct data availability sampling schemes from code commitments. Later, in FRIDA (CRYPTO'24), the same authors describe a compiler that takes an interactive oracle proof of proximity (IOPP) for a code and produces a secure code commitment. Chaining both results allows to construct efficient data availability sampling schemes from IOPPs.

In this short note, we give a novel security analysis that extends the results of FRIDA beyond the unique decoding radius of the code being used. This strict improvement leads to data availability sampling schemes with smaller commitments.

Towards our novel analysis, we define a variant of the opening-consistency property introduced in FRIDA, which we name opening-consistency with assign. Crucially, our new property does not depend on the unique decoding radius of the code. We then show that the FRIDA compiler can be applied to IOPPs that have opening-consistency with assign to produce secure code commitments. Finally, we show that under mutual correlated agreement, the batched FRI protocol (FOCS'20) satisfies opening-consistency with assign. This latter result is enabled by a recent analysis of FRI by Garreta, Mohnblatt and Wagner (ePrint 2025/1993).

Multivariate quadratic (MQ) signature schemes are an important class of post-quantum digital signatures. These schemes rely on the hardness of solving underdetermined MQ systems, where the number of variables \(n\) exceeds the number of equations \(m\). Therefore, analyzing the efficiency of algorithms for underdetermined MQ systems is essential for evaluating the security of MQ-based signature schemes. Several algorithms have been proposed to solve underdetermined MQ systems efficiently. Among them, Hashimoto's method is one of the best known partition-based direct attacks; it partitions the variables into three groups and reduces the original problem to two smaller MQ subproblems. In this paper, we propose a generalized partition-based algorithm for solving underdetermined MQ systems. The proposed algorithm extends Hashimoto's method by partitioning the variables into more groups and reducing the original problem to smaller MQ subproblems. We derive its applicability conditions and time complexity, and develop an efficient parameter search strategy to find the best partition parameters without a naive exhaustive search. Finally, we evaluate the proposed algorithm on parameter sets of MAYO, QR-UOV, and SNOVA, and compare the resulting estimates with those of existing algorithms for underdetermined MQ systems. In the classical case, the proposed method improves on Hashimoto's method for some parameter sets; in particular, it reduces the estimate for MAYO1 from \(2^{156}\) to \(2^{145}\). In the quantum case, the proposed method gives estimates smaller than both Just Guess and Hashimoto's method for many parameter sets.

Event date: 28 June to 1 July 2027
Submission deadline: 24 September 2026
Notification: 26 November 2026

Event date: 13 December to 16 December 2026
Submission deadline: 15 August 2026
Notification: 10 October 2026

Event date: 26 August to 28 August 2026
Submission deadline: 13 June 2026
Notification: 18 July 2026

Event date: 11 October 2026

Event date: 22 June to 25 June 2026

Event date: 26 August to 28 August 2026
Submission deadline: 13 June 2026
Notification: 18 July 2026

We are currently hiring at Simula UiB for a permanent Research Scientist or Senior Research Scientist position [*] in the Department of Cryptography, specialising in post-quantum cryptography.

We are seeking candidates with a PhD in cryptography, computer science, applied mathematics, or a related discipline. The successful candidate should be able to conduct both independent and collaborative, high-impact research and have experience in the design, analysis or implementation of post-quantum cryptographic schemes, demonstrated through publications in leading international venues. Expertise in related areas, such as cryptographic engineering, implementation security, side-channel analysis or applied cryptography more broadly will be an advantage.

Application deadline: 28 June 2026

For more information and how to apply: https://www.simula.no/careers/job-openings/research-scientist-in-cryptography-at-simula-uib

About Simula UiB: Simula UiB (simula-uib.com) is a research institute in Cryptography and Information Theory based in Bergen, Norway. The Department of Cryptography conducts research on the design and analysis of cryptographic algorithms, side-channel analysis and privacy-enhancing technologies. It currently comprises 13 members, including permanent staff, postdoctoral researchers and PhD students, and is led by Dr Martijn Stam. Simula UiB also hosts the Centre for Quantum Communication Networks and Applications (QCNA), one of Norway’s four national centres for quantum technology research, launched in May 2026.

[*] The Research Scientist and Senior Research Scientist levels at Simula UiB are broadly equivalent to Assistant Professor and Associate Professor positions in the university sector, respectively.

Closing date for applications:

Contact: Martijn Stam ([email protected])

More information: https://www.simula.no/careers/job-openings/research-scientist-in-cryptography-at-simula-uib

The candidate will be working on algorithmic and mathematical aspects of lattice-based and isogeny-based cryptography, in the context of to the ERC project AGATHA CRYPTY.

• The candidate should hold a PhD degree in Mathematics or Computer Science
• They should have a strong record related to some of the following topics: number theory, computational number theory, lattice-based cryptography, isogeny-based cryptography

The starting date is flexible, and applications should be submitted here: https://emploi.cnrs.fr/Offres/CDD/UMR5669-BENWES-004/Default.aspx?lang=EN

Closing date for applications:

Contact: Benjamin Wesolowski, https://emploi.cnrs.fr/Offres/CDD/UMR5669-BENWES-004/Default.aspx?lang=EN

We are seeking a highly motivated and internationally recognized scholar to join our department as an Associate Professor in Cryptographic Engineering. The position offers an exceptional opportunity to contribute to cutting edge research and education in a rapidly evolving field crucial to modern digital infrastructure, secure communications, and trusted computing. The successful candidate will play a key role in strengthening our research profile, fostering collaboration with national and international partners, and shaping the next generation cryptographic engineering experts.

The role entails a balanced portfolio of research, teaching, and academic leadership. The successful applicant will be expected to develop and lead research projects, obtain external funding, and publish in top-tier international venues (such as IACR CHES, IACR CRYPTO, IACR EUROCRYPT, ACM CCS, IEEE S&P). The position also involves contributing to the department’s educational mission through research-based teaching, supervision, and curriculum development at bachelor, master, and PhD levels.

The successful candidate is expected to conduct advanced research in cryptographic engineering, with emphasis on areas such as high‑assurance and performance‑optimized implementations of cryptographic primitives, formal verification techniques, and resistance against side‑channel, fault‑injection, and microarchitectural attacks. Research activities may also involve system‑level integration and deployment of cryptographic mechanisms in resource‑constrained or security‑critical environments, including wireless and embedded communication systems. The position further offers opportunities for interdisciplinary collaboration with researchers in adjacent domains within the department and across the university.

Closing date for applications:

Contact: Tjerand Silde

More information: https://www.jobbnorge.no/en/available-jobs/job/300865/associate-professor-in-cryptographic-engineering

The School of Computer Science & Information Technology at UCC invites applications for a permanent Associate Professor (Senior Lecturer) in Cybersecurity.
Cybersecurity is an area of strategic research importance to the School, and a focus area of teaching with a new MSc in Cybersecurity due to start in September 2026. The post will support the further development and delivery of this new MSc, engage in research that spans cybersecurity, cyber-physical security, data privacy, and security of AI.
We are looking for a world-class scientist with expertise in cybersecurity and specifically the intersection of AI and cybersecurity. The candidate requires expertise in cybersecurity, a track record of applying AI methods to cybersecurity problems and the ability and desire to:

• develop and lead research and teaching activities in Cybersecurity;
• establish and manage a significant world-class research team supported by competitively won research funding;
• supervise research students at PhD level;
• publish in leading conferences and journals in the cybersecurity domain;
• develop and strengthen links between the School of Computer Science and key industry organisations working in Cybersecurity;
• take leadership roles in cybersecurity across the University, nationally and internationally;
• contribute to the overall strategic development of the School;
• represent the School at internal and external events.

Appointment may be made on the Senior Lecturer Salary Scale: €84,749 - €120,082 (scale B). Candidates should apply before 12:00 noon (Irish time) on Tuesday, 9th June 2026. For an information package including full details of the post, selection criteria and application process see https://ore.ucc.ie/ (job ID: 094546).

Closing date for applications:

Contact: Prof Dirk Pesch at [email protected]

More information: https://my.corehr.com/pls/uccrecruit/erq_jobspec_version_4.jobspec?p_id=094546

Can a relevant cryptographic primitive, when instantiated over the NIST P-256 elliptic curve, achieve a bit-security level exceeding $128$ bits? Yes. We formally prove that the well-known password-authenticated key exchange protocol $\mathsf{EKE}$, introduced by Bellovin and Merritt (S&P 1992), achieves a generic security level of $128+\frac{1}{2}\log_2(N)$ bits, where $N$ denotes the size of the password space. To prove this result, we introduce and develop a new approach for showing that breaking a cryptosystem with a prescribed advantage requires solving many instances of an underlying computational assumption. To this end, we formulate the Hidden-Target Diffie-Hellman assumption. In this assumption, the adversary is given a set of $N$ Diffie-Hellman challenge instances. The Diffie-Hellman key of one uniformly random instance is designated as the hidden target. The adversary does not know which instance is the target, but may output an arbitrary subset of candidate solutions and succeeds only if this subset contains the target. We formally prove that breaking the Hidden-Target Diffie-Hellman assumption with probability greater than $(k-1)/N$ requires solving at least $k$ of the $N$ Diffie-Hellman instances. We then show that the security of $\mathsf{EKE}$ in the ideal-cipher model is equivalent to the Hidden-Target Diffie-Hellman assumption. A somewhat surprising consequence of this equivalence is that $\mathsf{EKE}$ achieves the claimed generic security level of $128+\frac{1}{2}\log_2(N)$ bits. Moreover, the equivalence implies that $\mathsf{EKE}$ remains secure even in settings where the hardness of $\mathsf{DLOG}$ or $\mathsf{CDH}$ is weaker than expected: an adversary may still need to solve on the order of hundreds or thousands of discrete logarithm instances in order to succeed, a task that may remain infeasible even for powerful attackers, including those equipped with early quantum computers.

Masking-based countermeasures such as Threshold Implementations and Probe-Isolating Non-Interference (PINI) are commonly assumed to protect cryptographic software against side-channel leakage by maintaining isolation between secret shares. In this work, we show that this assumption can break on modern out-of-order (OoO) processors due to backend microarchitectural effects that are not visible at the ISA level.

We present \texttt{OoOLyzer}, a trace-driven analysis framework that reconstructs physical-register reuse and backend execution interactions from OoO RISC-V pipeline traces. Using \texttt{OoOLyzer}, we identify leakage arising from backend physical-register reuse and transient overlap of masked-share operations inside OoO execution structures.

We evaluate the framework on a masked PRESENT implementation and composable PINI gadgets. Our analysis shows that although rotated-share computations protect selected nonlinear operations, affine share pairs remain directly represented in the architectural execution state. OoO register renaming can therefore induce physical-register transitions of the form \[ \operatorname{HW}_{\mathrm{bit}}(a_0[b]\oplus a_1[b]), \] which reconstruct affine PRESENT intermediates and create key-dependent leakage.

We validate the leakage experimentally in two stages. First, using a modified gem5 OoO RISC-V model, we attribute the dominant leakage source to backend physical-register reuse and demonstrate first-round PRESENT subkey recovery from masked execution traces. Second, on a real SiFive P550-class OoO RISC-V processor, we perform a temperature-based side-channel experiment using Linux-accessible thermal telemetry and recover 60 out of 80 key bits from the masked PRESENT implementation.

The results establish a complete cross-layer leakage path from masked software execution to OoO backend interactions, physical-register transitions, thermal behavior, and practical key recovery on real hardware. Our findings demonstrate that masking schemes appearing secure under software-level analysis may still leak on OoO processors, motivating hardware-aware verification of masked software deployments.

Private Information Retrieval (PIR) protocols allow a client to recover items from a server-held database without revealing the locations of requested items. In Symmetric PIR (SPIR), the client also learns nothing about the database beyond the requested items. Such schemes are critical for maintaining security in applications such as compromised credential checking, where database elements are considered as sensitive as queries. Existing approaches to building SPIR schemes require running multiple cryptographic primitives in parallel. Moreover, they do not naturally translate to the post-quantum setting, even though practical PIR schemes are typically post-quantum due to their reliance on learning with errors (LWE).

This work explores the possibility of deriving SPIR from PIR directly, utilising noise flooding to maintain the privacy of the database. While the common analysis based on the statistical distance leads to impractical parameters, we instead utilise arguments based on the Rényi divergence to obtain significantly improved parameters. We obtain simple single-server SPIR from state-of-the-art LWE-based PIR schemes with polynomial noise dimension and ciphertext modulus (concretely of 64 bits in size). Along the way, we note that practical schemes that utilise preprocessing via client-downloaded offline hints require extra protections for the database.

Overall, via an implementation of our approach, we show that post-quantum, round-optimal SPIR schemes can be constructed requiring online communication of 8 MB and server computation costs of 302 ms for a database of 1 million 1 kB elements.

At CRYPTO 2025, Qin et al. introduced the guess-and-determine (GD) rebound attack, which integrates the guess-and-determine approach by Bouillaguet, Derbez, and Fouque and the rebound attack by Mendel et al. Taking the GD rebound as a building block, this paper introduces several classical and quantum models to convert the semi-free-start (SFS) collision attack or free-start (FS) collision attack into collision attacks on DM hashing mode with AES. As an application, the first full quantum collision attack on AES-256-DM is proposed. Despite numerous round-reduced quantum or classical attacks proposed against the three popular hash modes MMO/MP/DM with AES over the past two decades, this is the first full attack that targets one of the three fundamental security requirements: collision, (2nd) preimage resistance. Our full attack on AES-256-DM improves the best previous attack by Taiyama et al. at ASIACRYPT 2024 by 5 rounds. Besides, some improved results on AES-128-DM and AES-192-DM are also given, which have been verified partially or fully by experiments.

In this note, we study decomposition of the Ate pairing on certain elliptic curves defined over finite fields. As an application, we reduce a generalized pairing inversion to root findings of an element of the affine coordinate ring appearing in the decomposition. For a supersingular curve $E / {\bf F}_q$ satisfying $\sharp E( {\bf F}_q ) = q+1$, heuristic observation suggests that a number of calls to a root finding algorithm seems to $O( N )$ where $N$ is the maximal power of $2$ dividing $q+1$. It is remarkable that the resulting algorithm does not utilize fixed argument pairing inversions. An underlying key observation is that the Miller function forms a factor system.